j-t-1 and GitHub
1cde9ae06e
Slightly modify volshell.rst
2024-12-10 09:46:28 +00:00
ikelos and GitHub
b8298a345f
Merge pull request #1169 from volatilityfoundation/mftscan_updates_resident_data_plugin
...
Add new resident data displaying plugin. Scan in correct layer. Condense code and remove duplication. Fix bugs
2024-12-09 20:24:27 +00:00
ikelos and GitHub
ec550232ac
Merge pull request #1388 from eve-mem/issue_1387
...
Interfaces: change allow list for filenames to ensure they work safely on windows. Fixes issue #1387
2024-12-09 18:58:40 +00:00
Andrew Case
582feccf93
Address feedback
2024-12-09 12:56:07 -06:00
eve
b86e839718
Interfaces: change allow list for filenames to ensure they work safely on windows. Fixes issue #1387
2024-12-09 18:30:19 +00:00
ikelos and GitHub
2ae723513a
Merge pull request #1386 from j-t-1/doc
...
Cosmetic changes to documentation
2024-12-07 17:19:38 +00:00
j-t-1 and GitHub
45f9064623
Cosmetic changes to documentation
2024-12-07 17:11:49 +00:00
j-t-1 and GitHub
e165c78ba7
Cosmetic changes to documentation
2024-12-07 16:37:39 +00:00
j-t-1 and GitHub
04d2554442
Cosmetic changes to documentation
2024-12-07 16:36:18 +00:00
j-t-1 and GitHub
97698cc5ed
Cosmetic changes to documentation
2024-12-07 16:29:58 +00:00
j-t-1 and GitHub
9ebc0bd90d
Cosmetic changes to documentation
2024-12-07 16:20:45 +00:00
Mike Auty
d29c23e922
Windows: Protect against missing _MM_SESSION_SPACE symbol
2024-12-07 15:52:58 +00:00
ikelos and GitHub
78e3ee26a0
Merge pull request #1384 from j-t-1/doc
...
Small documentation changes
2024-12-07 01:04:22 +00:00
j-t-1 and GitHub
93a47e811b
Small documentation changes
2024-12-06 21:52:51 +00:00
j-t-1 and GitHub
846403115a
Small documention changes
2024-12-06 16:00:03 +00:00
ikelos and GitHub
e2cdbdc2bf
Merge pull request #1382 from j-t-1/PYO
...
PEP 488 – Elimination of PYO files
2024-12-06 00:26:21 +00:00
j-t-1 and GitHub
f11ef06c27
PEP 488 – Elimination of PYO files
...
Python 3.5 implememted PEP 488, eliminating .pyo files.
2024-12-05 21:30:20 +00:00
j-t-1 and GitHub
5acf8858d9
PEP 488 – Elimination of PYO files
...
Python 3.5 implememted PEP 488, eliminating .pyo files.
2024-12-05 18:31:04 +00:00
Mike Auty
3ff304ceed
Layers: Fix intel bug introduced in commit 73d4f2f
...
The patch failed to mask the incoming address to the maximum physical
address. This allowed non-canonical addresses (potentially within the
page table) to be looked up incorrectly.
Fixes #1374 .
Thanks to @the-rectifier for quickly identifying the issue!
2024-12-03 19:58:23 +00:00
ikelos and GitHub
e4c552050c
Merge pull request #1377 from gcmoreira/pytest_image_autoselection_improvement
...
Testing: Enable automatic OS image selection by matching test name and image filename prefixes
2024-12-01 11:06:46 +00:00
ikelos and GitHub
fbc72d35b9
Merge pull request #1368 from gcmoreira/linux_pslist_dependencies_fix_1366
...
Linux pslist dependencies fix 1366
2024-12-01 11:00:12 +00:00
ikelos and GitHub
4d628c839b
Merge pull request #1376 from gcmoreira/fix_pretty_renderer_hex_bytes_as_text
...
Renderers - Fix HexBytes formatter for pretty renderer
2024-12-01 10:52:00 +00:00
Gustavo Moreira
535ce3a22a
testing: Enable automatic selection of the OS image based on the test and filename prefix, addressing an issue in the development environment.
...
For example, when using VSCode with pytest, test autodiscovery triggers pytest_generate_tests(), adding all images to each test case. This causes issues, as Linux tests end up being executed with Windows and Mac images, and vice versa.
2024-12-01 19:34:35 +11:00
Gustavo Moreira
c19a54cbd9
testcases: Minor cleanup: Renaming and reordering functions to align with the Linux/Windows test cases
2024-12-01 14:08:53 +11:00
Gustavo Moreira
7ae27c4eaa
Merge branch 'develop' into linux_pslist_dependencies_fix_1366
2024-12-01 13:24:53 +11:00
Gustavo Moreira
3c20e46902
renderers: Fix HexBytes formatter to apply padding also at the end of the string, ensuring proper output alignment when the pretty renderer justifies each line to the right
2024-12-01 12:36:35 +11:00
ikelos and GitHub
9222f4915a
Merge pull request #1371 from volatilityfoundation/issues/use-yara-scanner-over-handling-yara-directly
...
Fix up vmayarascan and vadyarascan to use yarascan properly
2024-12-01 01:26:04 +00:00
Mike Auty
d404747de5
Tests: Add in vadyarascan tests
2024-12-01 00:04:46 +00:00
Mike Auty
2dc1686289
Windows: Protect the SERICE_RECORD is_valid function a little more
...
The request to .Order could fail depending on where the structure lies
in memory.
2024-11-30 13:36:17 +00:00
Mike Auty
56f6ef0add
Include a test developed by @gcmoreira and @eve-mem
2024-11-30 11:52:16 +00:00
Mike Auty
3df385369c
Ensure the VAD/VMA gets scanned in a single block
2024-11-30 11:28:09 +00:00
ikelos and GitHub
ba98b088cb
Merge pull request #1369 from gcmoreira/logging_producer_information
...
Linux/Mac: Log producer metadata information
2024-11-29 10:27:32 +00:00
Mike Auty
393db1050f
Windows: protect again mz_offsets being None
2024-11-29 08:51:06 +00:00
Mike Auty
0030129ff8
Make suggested fixes to reduce loops and ignore insane sections
2024-11-29 08:43:04 +00:00
Gustavo Moreira
77778ee6f6
Linux/Mac: ISF metadata: Rename s/DWARF/POSIX/, as I'm not happy with the generic name. BTF source could potentially generate the same keys
2024-11-29 19:35:18 +11:00
Gustavo Moreira
b8023f0c97
Linux/Mac: Address code review suggestions
...
- Add getters for Linux/Mac ISF sources
- Avoid using internal attributes
- Use the dict repr instead of walking the dict to simplify code
2024-11-29 19:05:27 +11:00
Mike Auty
bec6bc6594
Fix up vmayarascan and vadyarascan to use yarascan properly
2024-11-28 16:59:52 +00:00
Mike Auty
3748cb89b8
Windows: Improve debugging output for pdbscan
2024-11-28 10:22:49 +00:00
Gustavo Moreira
8ecd7e2ddd
Linux/Mac: Log producer information
2024-11-28 15:17:22 +11:00
Gustavo Moreira
aaeec80fdf
linux: library_list testcase: Optimize testing performance by limiting the number of processes to just one. This change will reduce execution time and speed up the test
2024-11-28 13:53:11 +11:00
Gustavo Moreira
9048cd1ab8
linux: boottime: Minor, removed unnecessary blank line
2024-11-28 13:47:03 +11:00
Gustavo Moreira
fb4ab9d477
linux: test cases: remove unused variables
2024-11-28 13:45:26 +11:00
Gustavo Moreira
63ac0abe64
linux: Add 15 new test cases for plugins dependent on pslist
2024-11-28 13:25:08 +11:00
Gustavo Moreira
fa06064635
linux plugins: Update pslist major version and its 18 dependent plugins
2024-11-28 13:16:33 +11:00
Gustavo Moreira
97534f02de
linux: sockstat: It should import and verify the pslist version directly, instead of relying on lsof
2024-11-28 12:19:56 +11:00
Gustavo Moreira
7c559c53f4
test_cases: underscore unused variables
2024-11-28 12:11:14 +11:00
ikelos and GitHub
0233193c9d
Merge pull request #1335 from gcmoreira/linux_prot_none_L1TF_and_layer_addr_translation_fixes
...
Linux - PROT_NONE, L1TF mitigation and layer address translation fix
2024-11-27 10:31:18 +00:00
Gustavo Moreira
eff2a529c8
Linux: intel: Remove the bitwise zero complement to simplify the protnone mask calculation
2024-11-27 18:10:14 +11:00
Gustavo Moreira
641e008caf
Linux: intel: The non-present mapping shouldn't be inverted
2024-11-27 15:06:33 +11:00
ikelos and GitHub
bdd3e1e48e
Merge pull request #1365 from volatilityfoundation/issues/pr1343
...
CLI: Partial changes by @lesander contributed in #1343
2024-11-24 09:58:04 +00:00
